Salesforce: Finding Reports and Dashboards from Private folder

Use case: unable to delete report because it used in dashboards.

When you try to delete the report, Salesforce returns the following error:

Report cannot be deleted
One or more dashboards depend on this report. Please delete the dashboard components referring to this report and try again. 

The issue is, it does not tell us which dashboard content report that we want to delete.

So, let us find the related dashboards.

1. Create Report Type 
Reports (A) with at least one related record from Dashboard Components (B)
You can add Dashboard information to this report, such as:
- Dashboard ID
- Dashboard Running User (run as specified user, or let authorized users change running user)
- Folder
- Running User (this is viewing user name)
- Running User Active
- Title

You may find in some of the reports, there is no Dashboard info, even the report type is Reports with at least one related record from Dashboard Components, this is pretty confusing, right?

Possibility (1)
The dashboard has been deleted, you are right, however, once the dashboard is deleted (in recycle bin), the system allows you to delete the report.

 If you see from the above screenshot, the first line does not have dashboard info, this because the dashboard is deleted, and system allows me to delete the report, so this does not fit our use case.

Possibility (2)
The dashboard is stored in someone Private folder.

The difference here, we can see dashboard Title and no other info. For this case, we cannot delete the report.

2. Query from Private folders
For reports used as the source of dashboards that are stored in someone's private dashboard, you need to query from the Private folder. You need to have this permission of "Manage All Private Reports and Dashboards", so you can query the dashboard and report stored in the Private folder. You also need to add  'allPrivate' query scope to find Reports and Dashboards in private folders.

To return reports in private folders that haven't been run for more than one year:
SELECT Id, OwnerId FROM Report USING SCOPE allPrivate WHERE LastRunDate < LAST_N_DAYS:365

To query reports inside a specific User's private folder:
SELECT Id FROM Report USING SCOPE allPrivate WHERE OwnerId = '005A0000000Bc2deFG'

To query all dashboards stored in the User's private folder:
SELECT Id, Title, FolderName, FolderId, CreatedById, LastModifiedById FROM Dashboard USING SCOPE allPrivate ORDER BY Title 

Note:
For Dashboard:
- You should look at FolderId - this is where the dashboard or report is stored.
- The dashboard or report can be created by someone else, so don't look at CreatedById.

For Report:
- Look for OwnerId; this will tell you who owned the report stored in the private folder.


First Query
SELECT Id, DeveloperName, OwnerId, CreatedById, Owner.Name, CreatedBy.Name, CreatedBy.IsActive, Name, LastRunDate FROM Report USING SCOPE allPrivate

This query will return all reports stored in all user's private folders.

Second Query

SELECT Id, DeveloperName, OwnerId, CreatedById, Owner.Name, CreatedBy.Name, CreatedBy.IsActive, Name, LastRunDate FROM Report

This query will return all reports in your private folder, public folders, and all custom folders.

So, if you combine the results of the above query, you will get duplicate results for reports that sit in your private folder, so you can exclude those reports from the second query, such as

SELECT Id, DeveloperName, OwnerId, CreatedById, Owner.Name, CreatedBy.Name, CreatedBy.IsActive, Name, LastRunDate FROM Report WHERE OwnerId <> '00580000004JEgTAAW'

Reference: 

• Delete Reports and Dashboards from personal or private folders
• Locate Reports and Dashboards Stored within Personal or Private Folders

Einstein Analytics: deployment with Change Set

As Einstein Analytics is deeply integrated with the Salesforce platform, we can deploy Einstein Analytics asset as a Change Set from the Salesforce platform.

Here are a few finding related to Einstein Analytics asset deployment with Change Set:

1. Change Set able to deploy Dataflow to target org, event in the target org is not enable for sync. You need to enable sync for the ability to create dataflow manually in Data Manager.

2. For dashboard and lens deployment, if the app does not exist yet in the target org., you need to deploy the app as a component within the same Change Set, otherwise, the deployment will fail.

3. Change Set will deploy Dataset, but it will not move the data, you need to re-run dataflow or re-export the data, otherwise, the Dataset will not visible in Analytics Studio. However, dashboard and lens will visible in Analytics Studio, but you can't open them until the dataset is visible in Analytics Studio.

4. Change Set able to deploy Lens and Dashboard without Dataset.




Reference: Migrate Analytics Assets with Change Sets

Salesforce: Query Fields Permission

In the previous blog Using Permission Set to Query User Permission, we discussed query on PermissionSet and PermissionSetAssignment to query on permissions related to the user permission, at the end of the blog we also introduce query to ObjectPermissions object to get permission related to Object.

In this blog, we are going to introduce another object called FieldPermission. As you know, basic field accessibility for a user is determined by the user Profile, then extra permission can be given to the user through Permission Set. So, a query to FieldPermission will give you an idea of why/how a user able to access a specific field, and what is the permission to that field (Read or Edit).

SELECT Id, ParentId, Parent.Name, SobjectType, Field, PermissionsEdit, PermissionsRead
FROM FieldPermissions
WHERE SobjectType = 'Account' AND Field = 'Account.Active__c'
ORDER BY Parent.Name

The sample result from the above query:

The main field from the above query is ParentId, this field is referred to PermissionSet object, so you see the result of Parent.Name is PermissionSet.Name, the values are contained for both Profile and Permission Set.

For PermissionSet.Name value starts with X00e, it is a Profile (includes Standard and Custom profile), while the one not starting with X00e is PermissionSet.

From the above screenshot, let us check if Activate_Contract_2 permission set gives extra permission for the field Active__c in the Account object:

Sample 2: the below query checks the extra permissions given by the permission set to read and edit fields by a permission set called 'Activate Contract 2' and if the perm set also gives permission to edit read-only fields. 

SELECT SobjectType, Field, PermissionsRead, PermissionsEdit, ParentId, Parent.PermissionsEditReadonlyFields

FROM FieldPermissions

WHERE Parent.IsCustom=True and Parent.Name = 'Activate_Contract_2' ORDER BY Field 

Here are the read/edit permissions setting for the Account object in that perm set.  

The parent here object is PermissionSet, and the child object is the FieldPermission. 

IsCustom in PermissionSet means, if true, the permission set is custom (created by an admin); if false, the permission set is standard and related to a specific permission set license.

Sample 3: now we query the child from the parent object, this query shows the permission set or profile that gives allows to edit read-only fields and shows all fields access in the Account object

SELECT Id,Name,PermissionsEditReadonlyFields, IsOwnedByProfile, 

  (SELECT SobjectType, Field, PermissionsRead, PermissionsEdit

   FROM FieldPerms

   WHERE SobjectType = 'Account')

FROM PermissionSet

WHERE PermissionsEditReadonlyFields = true

Reference: 

• FieldPermissions
• PermissionSet